Zploit 0-Day Shell

:: Editing File: qdesc_edit.php

<?php
ob_start();

include 'header.php';
$page_title = "Edit Quotation Description";
include 'breadcrumb.php';
include 'menu.php';

// ============================
// Validate ID
// ============================
if (!isset($_GET['id']) || !is_numeric($_GET['id'])) {
    header("Location: qdesc_list.php?msg=Invalid Request");
    exit;
}

$id = intval($_GET['id']);

// ============================
// Fetch Existing Record
// ============================
$qry = mysqli_query($conn, "
    SELECT * 
    FROM quotation_descriptions 
    WHERE id = $id
");

$qdesc = mysqli_fetch_assoc($qry);

if (!$qdesc) {
    header("Location: qdesc_list.php?msg=Description Not Found");
    exit;
}

$message = "";

// ============================
// Handle Update
// ============================
if ($_SERVER['REQUEST_METHOD'] === 'POST') {

$category_id = intval($_POST['category_id']);
    $name        = mysqli_real_escape_string($conn, $_POST['name']);
    $status      = intval($_POST['status']);

if (!empty($category_id) && !empty($name)) {

$sql = "
            UPDATE quotation_descriptions
            SET 
                category_id = '$category_id',
                name        = '$name',
                status      = '$status',
                updated_at  = NOW()
            WHERE id = $id
        ";

if (mysqli_query($conn, $sql)) {
            header("Location: qdesc_list.php?msg=Quotation Description Updated Successfully");
            exit;
        } else {
            $message = "Database Error: " . mysqli_error($conn);
        }

} else {
        $message = "Category and Description Name are required.";
    }
}
?>

<div class="card-header pb-0">
        <h2>Edit Quotation Description</h2>
      </div>

<?php if (!empty($message)) { ?>
          <div class="alert alert-danger"><?= $message; ?></div>
        <?php } ?>

<div class="col-md-6">
              <label class="form-label">Category</label>
              <select name="category_id" class="form-control" required>
                <option value="">-- Select Category --</option>
                <?php
                $cat_sql = "SELECT id, name FROM quotation_categories ORDER BY name ASC";
                $cat_res = mysqli_query($conn, $cat_sql);

while ($cat = mysqli_fetch_assoc($cat_res)) {
                    $selected = ($cat['id'] == $qdesc['category_id']) ? "selected" : "";
                    echo "<option value='{$cat['id']}' {$selected}>{$cat['name']}</option>";
                }
                ?>
              </select>
            </div>

<div class="col-md-6">
              <label class="form-label">Description Name</label>
              <input 
                type="text" 
                name="name" 
                value="<?= htmlspecialchars($qdesc['name']); ?>" 
                class="form-control" 
                required
              >
            </div>

<div class="col-md-6">
              <label class="form-label">Status</label>
              <select name="status" class="form-control">
                <option value="1" <?= ($qdesc['status'] == 1) ? 'selected' : ''; ?>>Active</option>
                <option value="0" <?= ($qdesc['status'] == 0) ? 'selected' : ''; ?>>Inactive</option>
              </select>
            </div>

</div>

<div class="mt-4">
            <button type="submit" class="btn btn-success">
              <i class="fa fa-save"></i> Update
            </button>
            <a href="qdesc_list.php" class="btn btn-secondary">
              Cancel
            </a>
          </div>

</form>

</div>
    </div>
  </div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>